Cloud routines: Artifact publish raises an interactive permission prompt, so unattended runs hang in requires_action

Summary

In cloud routine (scheduled agent) sessions, the Artifact publish action raises an interactive permission prompt:

permission prompt Artifact: Claude wants to publish "/tmp/probe.html", uploading it to
claude.ai (Anthropic's servers) to host as a page, private to you until you share it.

Routine runs are unattended, so nothing can answer it. The session sits at worker_status: requires_action indefinitely. There is no timeout, no failure, and no notification. The routine silently stops producing output until a human opens the run and clicks.

This contradicts the documented contract. From Automate work with routines, verbatim:

Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run.

Same failure mode as #88112 (which is about read-only cp of persisted tool-results/ files), on a different trigger. Filing separately because the triggering action differs and this one has a clean before/after boundary.

It regressed mid-morning 2026-08-23 UTC

The same routine, publishing to the same artifact, stopped being able to publish unattended partway through the day. Nothing on my side changed the tool call.

| time (UTC) | run | model at init: | result |
|---|---|---|---|
| 2026-08-21, six runs | overnight sweep | claude-sonnet-4-6 | all completed, no prompt |
| 07:37 | overnight sweep | claude-sonnet-4-6 | completed, no prompt |
| 08:16 | overnight sweep | claude-sonnet-4-6 | completed, no prompt event in the log |
| 10:47 | overnight sweep (scheduled) | claude-sonnet-5 | prompted, hung ~3.3h until cleared by hand |
| 11:11 | weekly digest (scheduled) | claude-sonnet-5 | prompted, hung ~2.9h until cleared by hand |
| 13:55 | overnight sweep (manual) | claude-sonnet-5 | prompted, hung 8.5m until cleared by hand |

The 08:16 run (cse_01W7zVG1WmpQhQbX6wj5g58q) goes from tool_use Artifact to tool_result: Published ... at https://... in 1.6 seconds with no permission prompt event of any kind. Resolved prompts are visible in these logs, so that absence is meaningful: the 13:46 run (cse_01TttUTWAZTJH5VvhTVt1Cm8) shows permission prompt Artifact at 13:49:54 followed by Published at 13:50:10.

Ruled out: the model, and the tool-call shape

The regression window straddled a config edit of mine that pinned session_context.model from claude-sonnet-4-6 to claude-sonnet-5, and sonnet-5 emits a richer Artifact payload (it passes action and title, which sonnet-4-6 omitted). Both looked like plausible causes and both are wrong.

Control: a throwaway routine pinned to claude-sonnet-4-6, publishing a trivial page with the minimal payload {"favicon":"...","file_path":"/tmp/probe.html"}, no action, no title, no url. That is the same model and the same call shape as the run that published silently six hours earlier.

It prompted. (cse_01WiZybr9GPs2VeBzPCTpmR4, prompt at 14:05:39.)

Timing, and a negative control

#88112 reports that these prompts sometimes auto-resolve after roughly 13 to 33 seconds
and sometimes hang forever. Two of my publishes did complete in that band:

| run | prompt to result | outcome |
|---|---|---|
| cse_01TttUTWAZTJH5VvhTVt1Cm8 | 16.3s | published |
| cse_01WiZybr9GPs2VeBzPCTpmR4 | 12.2s | published |
| cse_017bhTkETLe2HixweLJors6h | ~3.3h | hung until cleared by hand |
| cse_01E8GmqaKYmC74XEWzo6nbbs | ~2.9h | hung until cleared by hand |
| cse_01A3mwksgQLsaToYo5aCd3KH | ~8.5m | hung until cleared by hand |

I was clearing a queue of stuck runs during that window, so I could not tell whether
those two were auto-resolved or clicked.

Negative control, deliberately untouched: I fired the same probe routine again
(cse_01UrdfZaS9cY76zpmrxCKt3g) and did not open the session or click anything. It
entered requires_action at 14:26:04 and was still there more than two minutes later,
roughly four times the upper bound of the band above.

So on this trigger the prompt does not appear to auto-resolve, and the two fast
completions were most likely a human clicking. Reporting the timings anyway in case
they are useful alongside #88112.

The permission dialog offers no persistent grant

The dialog rendered for this prompt has exactly two controls, Deny and Allow once. There is no "always allow" option, so an operator cannot pre-authorize the action even once by hand and have it stick. Combined with each routine run being a fresh session, every single run needs a fresh human click.

The docs say "Republishing an artifact you have already approved does not prompt again", which is not what happens here: the artifact had been published dozens of times to the same URL by the same routine.

Repro

1. Create a cloud routine with no repository attached, any environment.
2. Prompt: write a trivial HTML file, then publish it with the Artifact tool.
3. Fire it, unattended.
4. The run reaches the publish, enters requires_action, and stays there.

Impact

An artifact is the only durable output channel a repo-less routine has. A routine that publishes a dashboard or digest page is exactly the "unattended, repeatable, tied to a clear outcome" shape the routines docs recommend, and it cannot currently complete without a human. Worse, the failure is silent: list_runs has to be polled to discover a stuck run, and a run that did all its work correctly and then parked looks identical from the outside to one that has not started.

There is also still no API to approve or cancel a stuck run programmatically, as #88112 notes.

Expected

Any of:

• Artifact publish in an unattended routine session should not require interactive approval, per the documented "no approval prompts during a run".
• Or routines should be able to pre-authorize it in the job config (note that session_context.allowed_tools is currently accepted and echoed back but has no effect).
• Or an unanswered permission prompt in an unattended routine should fail the run after a timeout, so the failure is visible instead of silent.

Environment

• Cloud routine sessions, Anthropic-managed infrastructure, no repository attached
• Models: reproduced on both claude-sonnet-5 and claude-sonnet-4-6
• Local CLI used to inspect runs: 2.1.241